774025418bf41dc952f9ea338d75bd5d | Triage

Sharing

General

Target

774025418bf41dc952f9ea338d75bd5d
Size

28KB
MD5

774025418bf41dc952f9ea338d75bd5d
SHA1

768d960821f964ba5967e24b361a44bee11b7aa4
SHA256

98cf851216811315855c85f88485db7a8b49e46319ba471adddf8c1c9e9d0eac
SHA512

0d1e63b8f64271eb920c3db505f5d62177484776eac0f71f8885a757c7982610d1b6bf7589a08b34e9ab4953b5a4d4f00c908d7f3159771f551ba52e23e04dc2
SSDEEP

192:kZd73dPHhnJy3FKvZA4topONUkTM2yBbSx78WXkEgbVW4Gu9lplsigZaQy:8jPhJy4ZqATlyBOjcs4GSpGigZW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
774025418bf41dc952f9ea338d75bd5d

Files

774025418bf41dc952f9ea338d75bd5d
.dll windows:4 windows x86 arch:x86

8d3b1e7e15b78178be54d722f8efaaba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

FindWindowA
GetWindowTextA

msvcrt

_adjust_fdiv
malloc
_initterm
free
strlen
atoi
memcpy
strstr
??3@YAXPAX@Z
??2@YAPAXI@Z
memset
_strlwr

kernel32

VirtualProtectEx
TerminateProcess
CreateThread
OutputDebugStringA
GetModuleHandleA
Sleep
GetTempPathA
CopyFileA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
lstrlenA
lstrcatA
GetCurrentProcess
GetCurrentProcessId
ReadProcessMemory
lstrcpyA

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 846B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ